Zambia Interbank Payment and Settlement System (ZIPSS) Operating Rules

ZAMBIA INTERBANK PAYMENT AND SETTLEMENT SYSTEM OPERATING RULES October 2025

Bank of Zambia ZIPSS Rules i REGISTERED OFFICES Head Office Bank of Zambia, Bank Square, Cairo Road P. O. Box 30080, Lusaka, 10101, Zambia Tel: (+260) 211 399300 E￾mail: info@BoZ.zm Website: www.BoZ.zm Regional Office Bank of Zambia, Buteko Avenue, P. O. Box 71511, Ndola, Zambia Tel: (+260) 212 399600 E-mail: info@BoZ.zm Website: www.BoZ.zm

Bank of Zambia ZIPSS Rules ii Table of Contents 1.0 General Principles and Objectives .............................................................................................. 1 1.1 Roles of Bank of Zambia .......................................................................................................... 1 1.2 Background.............................................................................................................................. 2 1.3 The System .............................................................................................................................. 2 1.4 Business Days and Operating Hours........................................................................................ 3 1.5 Applicability of the Rules.......................................................................................................... 3 1.6 Liabilities of the BoZ................................................................................................................. 3 2.0 Access Criteria and Conditions.................................................................................................... 5 2.1 Categories of Participants........................................................................................................ 5 2.2 Operational Capacity ............................................................................................................... 6 2.3 Materials ................................................................................................................................. 6 2.4 Participant Primary and Fall-Back Facilities............................................................................. 6 2.5 Participant Staffing for ZIPSS Operations................................................................................. 7 2.6 Location of Computer Facilities................................................................................................ 7 2.7 Minimum Workstation Configuration Requirements............................................................... 7 3.0 ZIPSS Contingency Options......................................................................................................... 8 3.1 Gateway or Virtual Private Network........................................................................................ 8 3.2 Payment Originator................................................................................................................. 8 3.3 The Authorized Settlement Agent Facility................................................................................ 9 4.0 Processing Procedure ............................................................................................................... 11 4.1 Responsibilities of Participants .............................................................................................. 12 4.2 Gridlock Resolution ................................................................................................................ 15 5.0 Payment Message Processing................................................................................................... 17 5.1 Categories of Payment Messagesto be Processed on the ZIPSS............................................ 17 5.2 Irrevocability of Payment Instructions ................................................................................... 17 5.3 Transaction Limits.................................................................................................................. 17 5.4 Beneficiary Identification ....................................................................................................... 18 5.5 Payment Message Priorities .................................................................................................. 18 5.6 Modification of Priority.......................................................................................................... 18 5.7 Straight-through Processing .................................................................................................. 19 6.0 Liquidity Management ............................................................................................................. 20 6.1 Establishment of Reserves Accounts...................................................................................... 20 6.2 Provision of Intraday Loan Facility ......................................................................................... 20 6.3 Overnight Loans..................................................................................................................... 20

Bank of Zambia ZIPSS Rules iii 6.4 Settlement of Net Settlement Instructions............................................................................. 21 7.0 Adding Participants and Changesin Participants’ Status.............................................................. 23 7.1 Adding or Modifying a Participant......................................................................................... 23 7.2 Suspension or Termination .................................................................................................... 23 8.0 Security.................................................................................................................................... 26 8.1 Data Integrity, Availability, Confidentiality and Cyber Security Management....................... 26 8.2 Communications.................................................................................................................... 29 8.3 Use of BOZ-Supplied Materials .............................................................................................. 30 9.0 Establishment and Maintenance of Users................................................................................. 31 9.1 Token Certificate Applications ............................................................................................... 31 9.2 Request to Create a User....................................................................................................... 31 9.3 Modification of a User ........................................................................................................... 32 9.4 Creation and Maintenance of User Profiles ........................................................................... 32 10.0 Payment Message Format........................................................................................................ 33 10.1 Format................................................................................................................................... 33 10.2 ZIPSS Payments...................................................................................................................... 33 11.0 Reports and Enquiry Facilities................................................................................................... 35 12.0 Technical Failures..................................................................................................................... 36 13.0 Audit Rules............................................................................................................................... 37 14.0 Pricing Rules............................................................................................................................. 38 15.0 Administrative Requirements and Financial Rules.................................................................... 39 15.1 Audit Trails............................................................................................................................. 39 15.2 Publication of Statistics.......................................................................................................... 39 15.3 Conservation and Archiving of Documents............................................................................ 39 16.0 Business Disruption Event ........................................................................................................ 41 17.0 Force Majeure.......................................................................................................................... 42 18.0 Claims and Compensations....................................................................................................... 43 18.1 Correction of an Erroneous Order.......................................................................................... 43 18.2 Fraudulent or Erroneous Transactions................................................................................... 43 19.0 Dispute Resolution................................................................................................................... 44 19.1 Law and Jurisdiction............................................................................................................... 44 19.2 Conciliation and Arbitration Procedures................................................................................ 44 20.0 Insolvency of a Participant ....................................................................................................... 45 20.1 Notification of Insolvency Events........................................................................................... 45

Bank of Zambia ZIPSS Rules iv 20.2 Payment Instructions Submitted by the Insolvent Participant ............................................... 45 20.3 Queued Payment Instructions Submitted by the Insolvent Participant.................................. 45 20.4 Insolvency Proceedings During the Business Day................................................................... 45 20.5 Insolvency Proceedings after close of Business Day ............................................................... 46 21.0 Amendment of the Rules and Complementary Instructions...................................................... 47 21.1 Amendment to the Rules ....................................................................................................... 47 21.2 Complementary Instructions.................................................................................................. 47 Annex 1: Daily Operating Timetable ........................................................................................... 48 Annex 2: Help Desk .................................................................................................................... 49 Annex 3: Technical Documentation ............................................................................................ 50 Annex 4: Swift BIC Codes............................................................................................................ 51 Annex 5: ZIPSS Webstation Configuration .................................................................................. 52 Annex 6: Gateway/Payment Originator Connectivity Application Form...................................... 53 Annex 7: ASA Form..................................................................................................................... 55 Annex 8: Pricing ......................................................................................................................... 56 Annex 9: ZIPSS Window Extension Application Form.................................................................. 57 Annex 10: ZIPSS Validation Codes............................................................................................ 58 Annex 11: Audit Forms............................................................................................................. 61 Annex 12: Notification ............................................................................................................. 65 Annex 13: Message Priorities................................................................................................... 66 Annex 14: Form for Participant Addition or Modification ......................................................... 67 Annex 15: E-Token Application Form........................................................................................ 69 Annex 16: E-Token Revocation Form........................................................................................ 72 Annex 17: RTGS Transaction Type Codes.................................................................................. 74

Bank of Zambia ZIPSS Rules 1 1.0 General Principles and Objectives The purpose of this document is to define the System Rules for the Zambia Interbank Payment and Settlement System (ZIPSS) which is the interbank payment system or the Real Time Gross Settlement (RTGS) system for Zambia. These Rules are issued in accordance with the National Payment Systems Act Number 1 of 2007 (NPSA, 2007) and define the operating guidelines of the ZIPSS, together with the responsibilities and obligations of all Participants including the Bank of Zambia (BoZ) in its role of System Operator as well as Participant. 1.1 Roles of Bank of Zambia The BoZ shall be the System and Technical Operator of the ZIPSS with the legal responsibility for controlling, managing and operating the system.1 The BoZ administers the Settlement Accounts (SAs) of the Participants, provides intraday liquidity and other facilities to ensure efficient and sound functioning of payment systems. In this respect, the BoZ oversees the payment systems activities in Zambia and acts as a Settlement Agent and as System Operator of the ZIPSS. The BoZ shall be responsible for: • Authorisation of Participants in the ZIPSS; • The establishment and maintenance of these Rules and related Procedures; and • The issuance of operating standards and procedures for the ZIPSS. As System Operator, the BoZ shall be responsible for: • Making the ZIPSS available to Participants; • Providing a first level Help Desk support. • Making the ZIPSS Business Continuity arrangements available; • Keeping a record of all transactional data according to relevant Zambian law; The BoZ shall oversee the adherence of these Rules by the Participants. 1 Section 56 of the BoZ Act No. 5 of 2022 and the NPSA No.1 of 2007

Bank of Zambia ZIPSS Rules 2 As Technical Operator of ZIPSS, the BoZ shall administer the daily operation of the business cycle and shall be responsible for the security of system data, software and infrastructure, including managing backups and business continuity. The BoZ may, at its discretion, may delegate operational tasks to third parties. This delegation will not in any way affect the BoZ responsibilities towards the Participants. 1.2 Background The ZIPSS was upgraded from Version 3.0 of the Montran based System to Version 4.0 on 14 October 2023. The ZIPSS was also migrated to use the data rich ISO20022 messaging standard in line with global trends for cross border payments and other high value market infrastructures. The ISO 20022 messaging standard was developed by the International Organization for Standardization (ISO) as an open global standard for electronic data interchange between financial institutions. ISO 20022 was conceived to harmonise the fragmented financial messaging standards landscape. The Zambian Market will endeavour to leverage on the rich ISO20022 message standards to develop and incorporate the use cases that will benefit users of the ZIPSS. In addition, the topology of the system was also changed from FIN Y-Copy services to V-mode for sending of payment messages. With the adoption of the V-mode, the Bank has adopted alternative connectivity channels which Participants can use to send payment messages to the ZIPSS thereby enhancing operational resilience of the ZIPSS. 1.3 The System The ZIPSS (hereinafter “the System”) is an electronic payment system in which processing of transactions for settlement takes place continuously on a transaction-by￾transaction basis in real time. The ZIPSS is a key component of the Zambian financial system, settling interbank payments continuously and allowing for the instantaneous settlement of the cash leg of the securities’ transactions. The system ensures: • The final and irrevocable gross settlement in SAs of all high value and time critical payments initiated by Participants; • The final and irrevocable settlement in Participants’ SAs of the net clearing positions arising from the Deferred Net Settlement (DNS) as determined by the

Bank of Zambia ZIPSS Rules 3 Zambia Electronic Clearing House (ZECH), International Card Schemes and any other clearing systems approved by the BoZ; • The final and irrevocable settlement of the cash leg of the securities transactions processed through the securities clearing and settlement system operated by the Lusaka Securities Exchange; • The final and irrevocable settlement of transactions involving Government payments; • The final and irrevocable settlement of transactions involving securities processed through the Central Securities Depository (CSD) operated by the BoZ. 1.4 Business Days and Operating Hours The ZIPSS operating timetable is as defined in Annex 1, may be modified by the BoZ to extend operating hours in support of a 24/7 economy. 1.5 Applicability of the Rules These Rules shall be applicable to all Participants on the ZIPSS who will act in their own name. The “Rules” shall mean these Rules and each related annex and attachment thereof, as supplemented by related materials, including user manuals, system documents and other documentation provided (the Materials). Any of these materials may be reviewed and amended every 2 years or as deemed necessary. Where there is a conflict between these Rules and any annex, the terms of the annex shall prevail in respect of the relevant service. Section 21 describes how these Rules may be amended from time to time. All time indications in these Rules relate to the time at the place where the head office of the BoZ is located. The specific terminology of ZIPSS and the symbols used are explained in the Glossary. 1.6 Liabilities of the BoZ The liabilities of the BoZ as Technical Operator shall be limited to: • Making the system available;

Bank of Zambia ZIPSS Rules 4 • Ensuring the cyber security of the system; • Maintaining data integrity, availability and confidentiality; • Timely resolution of all ZIPSS challenges; and • Providing help desk support to Participants during the business day and operating hours of the ZIPSS (Refer to annex 2) The BoZ shall not be liable for any failure of ZIPSS resulting from the incorrect use of the system by the Participants or due to software errors or failures in communication infrastructure. Except as provided in this section, the BoZ shall have no liability whatsoever to any Participant or any other person for any loss, liability or expense suffered by such Participant or person arising from the actions of the BoZ. To the extent consistent with applicable law, the BoZ shall be liable hereunder only for its failure to act in good faith or to exercise reasonable care, which shall be determined in accordance with the reasonable commercial standards of the banking industry in Zambia. The BoZ shall not be liable for verifying the accuracy of any data or instructions provided by the Participant or a third party.

Bank of Zambia ZIPSS Rules 5 2.0 Access Criteria and Conditions In order to become a Participant, an institution shall comply with the Legal Soundness, Operational Capacity, Financial Soundness, Anti Money Laundering and Combating the Financing of Terrorism (AML/CFT), Sanction Screening and Cyber Security requirements. Documents describing the standards and communication protocols (and other functional requirements) for Participant’s interface to the ZIPSS shall be provided by the BoZ as itemised in Annex 3. Each Participant shall comply with, and its computer interface must function in accordance with, such standards and protocols. A computer interface shall not be implemented unless it has been approved by the BoZ. To ensure the proper and stable functioning of the system, the BoZ may make the participation in ZIPSS as well as the maintenance of such participation, dependent upon the successful outcome of tests demonstrating the required operational and technical capacity of Participants. The BoZ shall communicate the contents, conditions and dates of these tests to the concerned Participant. Each Participant shall have a Business Identifier Code (BIC) as issued by the Society for Worldwide Interbank Financial Telecommunications (Swift). Where appropriate, the BoZ may assign an unlisted BIC to a Participant that does not connect to the ZIPSS through the Swift network. The BICs of the Participants are specified in Annex 4. Each Participant shall be connected via a webstation as specified in Annex 5. The configuration will be to access the ZIPSS application via Virtual Private Network (VPN). Participants shall use the VPN and Swift network to enable Straight-Through Processing (STP) of transactions between their payment-originating systems and the ZIPSS. 2.1 Categories of Participants The following entities shall participate in the ZIPSS: • Commercial Banks licensed by the BoZ; • Clearing Houses authorised by the BoZ; • The National Treasury;

Bank of Zambia ZIPSS Rules 6 • The BoZ; and • Any other entity authorised by the BoZ. 2.2 Operational Capacity 2.2.1 Equipment Participants shall procure their own equipment to facilitate their participation on the ZIPSS. The BoZ shall not be obliged to supply to Participants any hardware or operating system software to enable utilisation of the services on the ZIPSS. The BoZ may provide to each Participant any necessary components such as a limited number of initial e-tokens certificates as determined from time to time. Participants shall install and configure the components to support the ZIPSS software in accordance with manuals and guidelines from the BoZ. The Participant shall at no time have any proprietary interest in the ZIPSS software. Any supporting components provided shall be returned to the BoZ on termination of participation in accordance with Section 2.3 of these Rules or earlier on demand. 2.3 Materials The Materials provided in connection with the services are the exclusive and sole property of the BoZ. The Participants agree to keep these materials confidential and to use them in the designated manner during the ordinary course of business. 2.4 Participant Primary and Fall-Back Facilities A participant shall put in place adequate infrastructure at its primary site for the purposes facilitating transaction processing on the ZIPSS. Each Participant shall provide business continuity arrangements for treasury management, accounting and access to the ZIPSS. Both primary and fall-back IT equipment shall be operated by qualified and authorised personnel who will take appropriate action on behalf of the Participant. The Participants will bear all expenses incurred in establishing any primary or fall-back facility connected to the ZIPSS.

Bank of Zambia ZIPSS Rules 7 2.5 Participant Staffing for ZIPSS Operations The office(s) of the Participant shall be managed by personnel who are qualified and authorised at all times, to take appropriate action on behalf of the Participant. 2.6 Location of Computer Facilities Any primary or fall-back connection linked to the ZIPSS shall be located only in a location deemed suitable and approved by BoZ. Any Participant wishing to change the location of its primary connection shall obtain the approval, in writing from the BoZ. Any changes to the location of a primary or fall-back connection shall not be a valid reason for requesting for amendments to the ZIPSS operating timetable. Any Participant wishing to change the location or the operational characteristics of its primary or fall-back facility must present a proposed plan describing the change and obtain approval from the BoZ in advance of making the change. BoZ reserves the right to require the Participant to alter the plan if in the opinion of BoZ, the plan poses a risk to the operational integrity of the ZIPSS. 2.7 Minimum Workstation Configuration Requirements Participants’ ZIPSS web stations must comply at all times with the minimum configuration requirements as detailed in Annex 5.

Bank of Zambia ZIPSS Rules 8 3.0 ZIPSS Contingency Options All ZIPSS Participants shall have a responsibility to make business continuity arrangements as per Section 2.4. However, where a Participant encounters a challenge and is unable to use their disaster recovery site on primary connectivity channel, they shall apply to the BoZ to use the alternative channel. The ZIPSS primary channel of exchanging payment transactions will be the Swift unless otherwise determined by the BoZ in consultation with the market. In the event of unavailability of the primary channel, Participants shall have options to use the Gateway and Payment Originator (PO) as alternative channels upon request and approval by the Bank. The PO shall only be used when the Participant fails to use the secondary channel. 3.1 Gateway or Virtual Private Network The gateway option shall be the secondary channel which Participants will use to connect to the ZIPSS to continue exchanging payment messages when the primary Swift channel is unavailable. Participants intending to use this channel will be required to make a formal application in writing explaining the challenges being experienced on the primary channel on the form in Annex 6 two hours before cut-off for the customer processing window. This is to allow for the process of switching the particular participant to the gateway by the BoZ and activation of the Gateway by the participant. Upon approval of the request, the Operator will communicate the switching of the participant to the Gateway via Email, after which the participant shall proceed to set up the Gateway. The procedure forsetting up the gateway is outlined in the Gateway Quick Reference Guide. 3.2 Payment Originator The Payment Originator (PO) is a payment module within the ZIPSS which is used to initiate non-STP payments by participants. The PO shall be the tertiary channel which Participants will use to continue exchanging payment messages when the primary Swift channel and the ZIPSS secondary gateway channel are unavailable. Participants intending to use this channel will be required to complete application form in Annex 6 one hour before cut-off for the customer payments window to allow for the process of

Bank of Zambia ZIPSS Rules 9 activating the particular Participant on the PO platform. The BoZ will review the request and provide feedback to the requesting Participant via email. The BoZ will communicate the activation and Participants will not be required to make any additional configurations to access the PO other than whitelisting the Uniform Resource Locator (URL) for the PO. 3.3 The Authorized Settlement Agent Facility The Authorised Settlement Agent (ASA) facility utilises the PO module within the ZIPSS to initiate non-STP payments on behalf of Participants. The ASA shall be the quaternary channel which Participants will use in some contingent situations where the participant would be unable to generate transactions from the core banking system through the primary Swift channel and when they cannot connect to the ZIPSS via the secondary gateway channel. Participants intending to use this channel will be required to make a formal application to the Assistant Director – Payment Systems Development and Operations, explaining the challenges being experienced on the primary, secondary and tertiary channels. The application to use the facility shall be sent to the BoZ at least one hour before cut-off for the customer payment processing window. The BoZ will review the request and provide feedback to the requesting Participant via email. The applying Participant is expected to fill ASA Forms in Annex 7 for the transactions to be processed. The Participant shall have the option to submit original authenticated payment instructions authorised by signatories in person by an approved officer or submit a scanned copy sent by an authorised signatory to zipss.helpdesk@boz.zm. Where the BoZ accepts the scanned copies of the ASA instructions sent by an authorised signatory to zipss.helpdesk@boz.zm, the Participant accepts to indemnify the Bank against any loses that may be incurred in processing the duly authorized instructions on behalf of the Participant.

Bank of Zambia ZIPSS Rules 10 3.3.1 Transactions processed under the ASA Facility The BoZ will only process critical and systemically important payment transactions such as; • Interbank transactions; • Cash withdrawals; • Government securities transactions; • Payments to the BoZ; • ZRA transactions; • Any other transaction type as may be deemed by the Bank A charge will be applied for each transaction that is processed on behalf of a Participant and the total amount charged will be debited from the Settlement Account of the Participant. Refer to Annex 8 – Pricing.

Bank of Zambia ZIPSS Rules 11 4.0 Processing Procedure Participants shall comply with the timetable in Annex 1 and shall undertake to submit for settlement the different types of payment instructions before the cut-off times stated in the timetable. Participants wishing to apply for the ZIPSS processing window extension shall be required to complete and submit the form in Annex 9 no later than one hour before the cut-off time for the customer payment processing window. The completed application shall be signed by two (2) authorised signatories and sent to zipss.helpdesk@boz.zm. The BoZ shall review and determine the duration of the extension from the default cut￾off time and reserves the right to reject or deny such applications for extension. The conditions under which the Bank shall consider extending the system: • System wide challenges on the ZIPSS; • Challenges on the Automated Clearing House platforms, that is, EFT, CIC and NFS; • Processing of systemically important/critical payments (Government related payments or any critical payment as may deemed by the Bank); • Challenges impacting the ZIPSS on account of integration with payment systems such as the CSD; • Where all or a significant number of Participants fail to process payments via the Swift network or VPN, The BoZ may consider modifying the Operating Timetable for the current day in order to provide sufficient time for all Participants to complete processing payments. Any changes to the location of a primary or fall-back connection to the ZIPSS shall not be a valid reason for requesting any changes to the ZIPSS operating timetable. Extensions to the system timetable shall be communicated by BoZ to the participants within the hour of having extended the system.

Bank of Zambia ZIPSS Rules 12 4.1 Responsibilities of Participants The Participants shall issue their payment instructions to the ZIPSS in accordance with these Rules. Participants are individually responsible for: • The fulfilment of their obligations resulting from these Rules; • The quality of the data they send; • The compliance to the message formats agreed upon; • Securing access to the ZIPSS webstation(s) in accordance with the security procedure under these Rules; • Strictly complying with the procedures and the rules governing access to the system; and • Ensuring that only duly authorized users access the system. 4.1.1 Risk Management The Participants will conduct their business with one another in the utmost good faith and integrity to minimise any risk of loss inherent in participating on the ZIPSS. To this end, each Participant will: • manage its business to avoid creating or increasing risk to the other Participants to avoid settlement failure; • manage its liquidity in order not to adversely affect the liquidity of other Participants by ensuring prompt settlement of its obligations; • ensure the integrity, compliance and functionality of all of its systems, including hardware, software, human resources and data received and transmitted to the ZIPSS; and, • Its backup systems and facilities are adequate alternativesto fulfil its obligations efficiently and effectively on the ZIPSS. 4.1.2 Monitoring of Payment Flows and Reconciliations Each Participant shall be responsible for monitoring the settlement of the payment messages it has sent throughout the day, the volume and value of payments stored in its outward pending queue, any queued net settlement instructions, the balance of its SA,

Bank of Zambia ZIPSS Rules 13 its ILF and the level of its reserves. Each Participant shall aim to avoid having unsettled payments. Where transactions are pending, the Participant shall take the necessary action to clear them before the Final Cut-Off (FCO). The BoZ shall not be liable for any loss incurred by a Participant’s failure to monitor and reconcile its payment flows. The BoZ and the other Participants shall not be held liable for failure to monitor payment flows and failure to reconcile ZIPSS transactions, pursuant to Section 19.1 of these Rules. 4.1.3 Submission and Validation The Participants shall take all necessary measures to optimise the smooth flow of the payments, by adhering strictly to the timetable in Annex 1. Payment Instructions sent by Participants shall immediately be validated by the ZIPSS. If a payment instruction is accepted or rejected, a message shall be sent to the sending Participant. A list of error codes is set out in Annex 10. The ‘handover point’ between a Participant and ZIPSS is the point of Technical Acceptance when the ZIPSS has received and validated a message as being correctly formatted and accepted for settlement. An acknowledgement message is sent to the sending Participant at this point. Where the Participant sending the payment instruction has sufficient funds available, the payment shall be settled (paying Participant debited, receiving Participant credited) and immediately becomes final and irrevocable. The detailed flow of messages processed on the ZIPSS is specified in the Message Flows and Technical Specifications Documents. The accepted messages are recorded and chronologically processed by the system according to the FIFO (“First In First Out”) principle within the specified Priority. 4.1.3 Queuing The ZIPSS payments shall be settled as follows: • Where a Participant has insufficient funds, the payments shall be queued until funds become available.

Bank of Zambia ZIPSS Rules 14 • Where the SA remains insufficiently funded at FCO, the pending transaction shall automatically be cancelled by the system and will attract a charge as detailed in Annex 8 – Pricing. 4.1.4 Reprioritising of Payment Instructions in the Pending Queue A Participant who wishes to reprioritise the settlement of a payment message, shall assign a higher priority code to such a message. The order in which payment messages in the pending queues are executed depends first on the priority and second on the time they are validated by the ZIPSS. All payment messages with the same priority shall be processed on the basis of the FIFO (“First In First Out”) principle. 4.1.5 Access Control Participants shall comply strictly with the procedures and the rules governing access to the ZIPSS. Only duly authorised Users who have been issued with an access control e￾token by the BoZ may use the system. The erring Participant is liable for any damages resulting from non-compliance with the procedures or from improper or fraudulent use thereof. 4.1.6 Review of Users Participants shall regularly review all user access and report quarterly and annually on the forms prescribed in Annex 11. Should the reports provided contain material errors, the Participant shall be penalised. 4.1.7 Reporting Fraud Each Participant shall ensure that its own systems and procedures provide appropriate protection against fraudulent activity in connection with the system. All fraudulent activity must be reported to the office of the Director – Payment Systems (Refer to Annex 12 - Notification) immediately the Participant becomes aware of it, regardless of whether such fraud is on the part of the Participant’s staff, its customer or anyone else. The report should be communicated via email or letter providing as much information as possible. All reasonable assistance requested for by the BoZ or any other Participant involved in the fraud must be availed.

Bank of Zambia ZIPSS Rules 15 4.1.8 Constraining Event Where there is a constraining event (i.e. events which affects the ability of a Participant to participate to the normal and usual extent in sending and receiving payments), the Participant involved shall inform the BoZ immediately and do everything possible to resolve the issue in the shortest possible time. 4.1.9 Cancellation of Queued Payment Instructions Payment instructions queued by the ZIPSS may be cancelled by the sending Participant. Where any queued payment messages create a gridlock, the BoZ may cancel the transactions to unlock the gridlock situation on the system. In such a case the BoZ shall immediately inform the sending Participant(s). The ZIPSS shall automatically cancel any queued payment messages for the current business day value that have not been settled at FCO. 4.1.10 Processing of Net Settlement Instruction Where an NSI is not settled due to insufficient funds on any Participant SA, it shall be queued in the normal way. NSI transactions cannot be cancelled and as such Participants shall be required to make funds available to settle the pending NSI. 4.2 Gridlock Resolution 4.2.1 Initiation of Gridlock Resolution Where the value of the payment messages in the pending queue leads to saturation of the system, or where two or more Participant’s queues become blocked with payment messages, gridlock resolution within the ZIPSS shall be initiated automatically. Participants shall be expected to monitor their SAs during the day and ensure that they have sufficient funds available to meet their settlement obligations. The BoZ will monitor the position of each Participant and may advise them to take the necessary steps to unblock the gridlock situation.

Bank of Zambia ZIPSS Rules 16 4.2.2 Delayed Gridlock Resolution Initiation of gridlock resolution shall automatically be delayed by the entry of an NSI until such time the NSI is settled. If gridlock resolution is already running when an NSI transaction is entered, it will be completed before the NSI is processed.

Bank of Zambia ZIPSS Rules 17 5.0 Payment Message Processing 5.1 Categories of Payment Messages to be Processed on the ZIPSS The ZIPSS shall process the following categories of payment messages: • Gross payments in accordance with the principles of RTGS; and • Consolidated NSIs. All payment messages processed through the ZIPSS shall be in Zambian Kwacha (ZMW) or any other currencies that may be introduced by the BoZ. The payment messages shall be processed with same-day value unless a future value date is specified. Future value dates must not be more than 10 working days ahead of the current working day. The ZIPSS shall settle interbank payment messages for both Participants and their customers. 5.2 Irrevocability of Payment Instructions 5.2.1 Moment of Entry into the System The moment of entry into the system is the point of the technical acceptance of a payment instruction by the ZIPSS, that is, after validation but before acceptance for settlement (before passing the available funds test) or queuing of the payment messages by the ZIPSS. As from that moment, the settled payment message will be protected against claw-back in case of insolvency of the Participant concerned. 5.2.2 Irrevocability and Finality of Payment Instructions Settlement will be final and irrevocable once settlement accounts of the respective Participants have been credited and debited with the amount specified in the payment message. 5.3 Transaction Limits There is no minimum or maximum limit for the amounts that may be processed through the ZIPSS, either as individual gross payment messages or NSIs.

Bank of Zambia ZIPSS Rules 18 5.4 Beneficiary Identification Participants must comply with all the message guidelines regarding the presentation of agreed additional data for: • The Zambia Revenue Authority (ZRA) payment messages; and • Payment messages for ordering currency from the BoZ. The Payment Reference Number (PRN) must always be used in the appropriate element for all ZRA payment messages. This information must be provided according to the message formats published in the usage guidelines on the ZIPSS MyStandards Portal by the BoZ and the documentation as listed in Annex 3. 5.5 Payment Message Priorities The Participants will assign priorities to Payment messages by default using the Transaction Type Codes (TTCs) which will determine the priority with which the messages will be settled by the ZIPSS. NSIs will have the highest priority followed by BoZ payments. However, Participants will have the ability to modify the priority if the transactions are not settled immediately on account of insufficient funds as these transactions will go into the pending queue. This notwithstanding, the order in which payment messages in the pending queue shall be settled will depend first on the priority, and second on the time they are validated by the ZIPSS within each priority range. The range of message priorities is defined in Annex 13. 5.6 Modification of Priority A Participant may modify the priority of a pending payment message that it has submitted for settlement. Where a Participant has insufficient funds on the SA, any payment that is authorised will be sent to the pending queue until funds become available to settle the queued payments. Therefore, Participants will be able to modify the settlement priorities of these pending payments.

Bank of Zambia ZIPSS Rules 19 5.7 Straight-through Processing All participants shall be required to implement straight-through processing (STP) for payment messages settled on the ZIPSS. Each Participant shall implement STP for outgoing payment messages, which shall be generated from a Participant’s Core Banking System (CBS). Participants shall process manual customer payment instructions submitted over the counter within one hour from the time such payment instructions are submitted. Each Participant shall implement STP for incoming payment messages to ensure that all payments credited to a Participant’s SA are immediately applied to the beneficiary accounts on the CBS. Participants shall apply the funds from incoming payment messages on the CBS by, at a minimum, reference to the account name and account number. In exceptional cases where manual intervention is required for such settlements to be effected on the CBS, such interventions shall not take more than one hour after successful settlement on the ZIPSS. Where the account number is incorrect, participants shall be required to return the funds as per provisions made in Section 18.1 - Correction of an erroneous order. The BoZ may take supervisory action on Participants who fail to meet these requirements in accordance with existing provisions of the National Payment Systems Act.

Bank of Zambia ZIPSS Rules 20 6.0 Liquidity Management 6.1 Establishment of Reserves Accounts The Participants on the ZIPSS may have a number of RAs linked to their SA. The establishment of such accounts will allow participants to move funds where they can only be used for designated purposes. Participants can move funds into and out of RAs unless otherwise restricted by the BoZ. In addition to the SA and SRA, each Participant shall have: • NSI Reserve Account which will hold funds reserved for settling obligations arising from clearing operations; • Cash Reserve Account for holding funds for settling cash withdrawals; • Cash Collateral Reserve which will be used to hold collateral pledged for clearing transactions which mature in the books of the BoZ; and • Securities Collateral Reserve will be used for settling NSI transactions which are settled using the collateral pledged for clearing transactions. 6.2 Provision of Intraday Loan Facility The BoZ shall provide interest free intra-day credit to Participants during the period prescribed in Annex 1. Participants will be able to pledge government securities on the Central Securities Depository (CSD) system, for use as collateral on the ZIPSS for the Intraday Loan Facility (ILF). Participants will only use ILF to the tune of the value of securities pledged after taking into account the haircuts as shall be determined by the BoZ. 6.3 Overnight Loans Any ILF that has been used during the day will mature at Final Cut-off. Each Participant shall ensure that they have sufficient funds to pay back the ILF. Where a Participant does not have sufficient funds at this point, the BoZ reserves the right to grant an Overnight Loan Facility (OLF) against acceptable collateral in a Repurchase Agreement (REPO) transaction. The amount of the overnight loan shall be credited to the Participant’s SA by the system automatically after Final Cut-Off to

Bank of Zambia ZIPSS Rules 21 enable ZIPSS to complete End of Day processing. The system will automatically recover the principle and interest amount of the OLF at the start of the next business day. 6.4 Settlement of Net Settlement Instructions NSIs shall be submitted automatically to the ZIPSS at the specified settlement time by an authorised ACH. A Participant shall ensure that sufficient liquidity is available to settle the NSI generated at the end of each clearing session in accordance with the rules of the clearing house. NSIs generated by an authorised ACH from clearing operations shall settle in Participant SAs as “all-or-nothing” multi-party transactions, with all debits and credits settling simultaneously as a batch. It shall be the responsibility of each Participant to ensure that they have sufficient funds in their SA and/or NSI Reserve Account (RA) to cover their net position in each settlement session from the ACH. As soon as an NSI is entered into the ZIPSS for settlement, funds to the tune of the net debit amount shall automatically be blocked in the SAs of Participants that have a net debit position, to enable the immediate settlement of the NSI. Where the funds are not available in both the SA or the NSI RA of a Participant with a debit position, the NSI shall be queued until sufficient funds become available. In the event of a Participant not providing sufficient funds in the two accounts, the ZIPSS will automatically transfer the available fundsin Cash RA and/or Cash Collateral RA to meet the settlement obligation. Where, the RAs do not have sufficient funds, the ZIPSS will call on the securities pledged on the CSD to meet the net obligation. The portion of the collateral required will be credited to the SA in order to meet the NSI settlement obligation and will be reflected in the Securities Collateral RA. The Participant who utilises the pledged collateral will be required to comply with the collateral requirements at the end of the day. Therefore, the CSD will call for the portion so utilised by the Participant before end of day and the Participant is required to make the funds available in the SA.

Bank of Zambia ZIPSS Rules 22 Where collateral is pledged for NSI transactions, the Participant consents that the BoZ shall, without prior notification, utilise the pledged collateral to settle pending obligations arising from the clearing sessions (Refer to Section 158 of the BoZ Act of 2022 and CB Circular No. 10/2023: National Payment Systems Collateral Requirement for Net Settlement Obligations on Payment Systems Collateral). Where the pledged securities are insufficient to settle the NSI obligation, the BoZ reserves the right without notifying the Participant to transfer funds from the SRA to the SA to facilitate the settlement of an NSI. The Banking Division will facilitate the transfer of funds for the Participant from the SRA to the SA. The Participant shall be expected to comply with the statutory requirements as shall be determined by the BoZ from time to time. A Participant that causes the NSI not to settle at the designated time shall be charged a penalty. Refer to annex 8 – Pricing.

Bank of Zambia ZIPSS Rules 23 7.0 Adding Participants and Changes in Participants’ Status 7.1 Adding or Modifying a Participant The BoZ shall have the exclusive right to admit new Participants into the ZIPSS. Each applicant shall provide the information stated in the Participant Application Form provided in Annex 14. Where there is a merger, split off, name change or any other change in the information required in the Participation Application Form in Annex 3, the Participant involved shall notify the BoZ immediately to provide the information required to amend its details. 7.2 Suspension or Termination 7.2.1 Suspension The BoZ may suspend a Participant from accessing the ZIPSS (that is, “Block” or “Disable” the Participant) for a specified or indefinite period of time in the following circumstances: • The Participant is subject to prudential supervision and the relevant supervisor requests such suspension; • By agreement with the Participant concerned; • The Participant no longer complies with a requirement for participation set out in the Rules; • The Participant encounters a constraining event which affects, or may affect, the ability to participate in the normal and usual extent to send and receive payments for a period of time, but only during the continuance of that event and any subsequent period which might be necessary; • An insolvency event (as defined under the Insolvency Act2 ) occurs in respect of the Participant (not being an event which results in a termination pursuant to section 7.2.2 below); 2 Insolvency Act of 2017

Bank of Zambia ZIPSS Rules 24 • The Participant breaches its obligations under these Rules or the applicable procedures and fails to rectify the breach or to provide a satisfactory justification; or; • The Participant fails to comply with any other relevant conditions, rules, agreements, regulations as issued by the BoZ. The BoZ shall at its discretion decide on any term or grace period of such suspension, taking into account the specific situation of the Participant concerned. A Participant whose access to the ZIPSS is suspended under this section still has a right to access its data outside the system via a request to the BoZ. A Participant whose access to the ZIPSS is suspended is not excused from discharging its obligations under these Rules, except as expressly provided in or pursuant to these Rules. From the moment the BoZ decides that the suspension becomes effective, any payment message from the respective Participant is no longer accepted until the reinstatement date. The BoZ shall immediately notify all Participants (by the most expeditious means available) of any suspension. The BoZ may at its discretion reinstate a suspended Participant and shall as soon as reasonably possible, notify all Participants of any decision to reinstate a suspended Participant including the re-commencement (“activation”) date for that Participant. 7.2.2 Removing of Participant from the ZIPSS The BoZ may disable or remove a Participant from the ZIPSS for a specified or indefinite period of time in the following circumstances: • The Participant is subject to prudential supervision and the relevant supervisor requests such suspension, disabling or removing of the Participant; • Resignation; • Becoming insolvent; • Being wound-up, dissolved or otherwise ceasing to exist; or • The Participant fails to comply with any other relevant conditions, rules, agreements, regulations as issued by the BoZ; and

Bank of Zambia ZIPSS Rules 25 • The Participant encounters a constraining event which affects, or may affect, the ability to participate in the normal and usual extent to send and receive payments for a period of time, but only during the continuance of that event and any subsequent period which might be necessary; BoZ shall at its discretion decide on any term of such removal, taking into account the specific situation of the Participant concerned. A Participant whose access to the ZIPSS is suspended, disabled or removed under this section still has a right to access its data outside the system via a request to the BoZ. A Participant whose access to the ZIPSS is suspended or disabled is not excused from discharging its obligations (any fees, costs, charges and expenses which may be levied) under these Rules, except as expressly provided in or pursuant to these Rules. From the moment the BoZ decides that the suspension becomes effective, any payment message from the respective Participant is no longer accepted until the reinstatement date. The BoZ shall immediately notify all Participants (by the most expeditious means available) of any suspension or disabling of a participant. The BoZ may at its discretion reinstate a suspended or disabled Participant and shall as soon as reasonably possible, notify all Participants of any decision to reinstate a suspended or disabled Participant including the re-commencement (“activation”) date for that Participant. A Participant may, by way of notice in writing to the BoZ, withdraw participation with effect from a date, which is 10 business days after the date of service of notice to withdraw participation. The notice shall be irrevocable. However, all licensed commercial banks within the BoZ’s definition, shall maintain their membership in the ZIPSS. The BoZ shall not be obliged to give any reasons for termination and may revoke any such notice at any time before it becomes effective. A Participant whose access is terminated shall not be entitled to be repaid all or part of any entrance, operating or other fees, which has been paid by it.

Bank of Zambia ZIPSS Rules 26 8.0 Security 8.1 Data Integrity, Availability, Confidentiality and Cyber Security Management The BoZ warrants that the System has been designed and implemented to a high standard of security and reliability, with the objective of maintaining the integrity, availability and confidentiality of all data handled by the system. The BoZ shall maintain strict confidentiality of all information provided by Participants and/or processed through the System. 8.1.1 Consent to Sharing Information with Third Parties By consenting to these Rules, Participants authorise the transfer of any information relating to it between BoZ and third parties selected by BoZ for confidential use in connection with the provision of services to the Participants (including for data processing purposes). Further, Participants acknowledges that BoZ and any such third party shall be entitled to transfer any such information as required by any law, court, legal process or as requested by any authority in accordance with which it is required to act, as it shall determine. 8.1.2 The Operator Role on Erroneous Transactions The Participants acknowledge that the ZIPSS is designed to process instructions as submitted and not to detect errors in transmission or content including discrepancies between account names and numbers. The BoZ has no duty to discover and shall not be liable for errors made by or duplicate instructions issued by a Participant. The Operator role shall be limited to confirming settlement of transactions on the ZIPSS. Participants hereby agree to resolve any disputes regarding erroneous transactions bilaterally. 8.1.3 Password Policy Management All Participants shall at all times adopt and implement the password policy issued by the BoZ. The Password policy will be administered by the BoZ at the System level and all Participants will be required to comply to the policy in place at any particular time.

Bank of Zambia ZIPSS Rules 27 8.1.4 Participant Internal Controls The Participants shall develop and maintain adequate internal security procedures and comply with all fraud and cyber security procedures. They shall ensure that the payment flows in their internal systems are adequately protected against any internal or external threats and the data integrity, availability and confidentiality must be safeguarded at all times. 8.1.5 Cyber Security Risk Management Frameworks and Measures Participants shall implement within their Overall Cyber Security Policy and Strategy, measures and capabilities based on the National Institute of Standards and Technology’s “Framework for Improving Critical Infrastructure Cybersecurity” (NIST Framework or CSF), and has direct correlative mappings to International Organisation for Standardisation/International Electrotechnical Commission (ISO/IEC 27001/2) controls that quickly identify and quarantine threats in order to preserve the confidentiality, integrity and availability of information on the ZIPSS. In addition to this and at a minimum, in line with Cyber Security Guidelines and controls issued under Gazette Notice 668 of 2023 on 19 May 2023, each participant shall implement on the ZIPSS the following measures: • Restricted Physical Access Physical access to all equipment (workstations, servers, certificates) related to the use of the ZIPSS including at the fallback sites shall be restricted and strictly controlled from being accessed by unauthorized persons. • Segregation of duties Participants shall ensure segregation of duties by allocating user profiles that separate business functions and duties. • Token Certificate Management Each user shall have the responsibility to ensure that their e-token certificate is always kept safely to avoid unauthorised persons from accessing the system. The

Bank of Zambia ZIPSS Rules 28 default e-token password must be changed when the token is used for the first time and the new password must not be shared with anyone. • Password Management The users shall create strong and unique passwords whose complexity shall have a minimum of eight characters, a combination of upper and lowercase letters and either a number or symbol/special character. The system provides default password validity period of 90 days and a maximum number of three login attempts to curtail the possibility of unauthorised access. Therefore, users should ensure that the passwords are changed regularly and that they are never shared with another person. Where a user suspects that a password may have been compromised, it should be changed immediately. • Cyber security awareness. Participants shall ensure that they regularly undertake cyber security awareness training for all the employees involved in operating the ZIPSS. Refer to Annex 11. • Cyber Security Incident Response Guide Each participant shall have in place an incident response plan to deal with material cyber security breaches or attempts. A recovery and assurance plan shall ensure system’s integrity following the cyber security incident as well as recovery of lost or corrupted data on account of the incident. • Cyber Communication and Information Sharing Strategy Participants shall ensure that they report major cyber security breaches on their systems and networks to the BoZ and the Cyber Security Incident Reporting Team (CIRT) within 24 hours of discovering the breach. The incidents shall be reported through email at zipss.helpdesk@boz.zm. 8.1.6 Appointment of Participant Security Administrators Each Participant shall designate among its staff a minimum of two Participant Security Administrators (PUSAs) who will be responsible for communication with BoZ and executing tasks regarding:

Bank of Zambia ZIPSS Rules 29 • Set-up of users; • Amendment of user profiles; • Removal of users from the system; • Review of users and submission of the quarterly audit certificates. Refer to Annex 11; • The management of e-token and certificate issue and delivery to end-users. Participants agree to always put in place business continuity measures for PUSA responsibilities. The BoZ shall not be responsible for providing this service on behalf of participants. The BOZ shall maintain the list of Participant Security Administrators. 8.2 Communications The Participant agrees that the ZIPSS services shall be provided using the communication methods described in these Rules. The Participants agree to comply with the applicable procedures and the methods designated in these Rules. The BoZ is not obliged to follow instructions unless transmitted in accordance with these Rules. Nonetheless, the Participants hereby agree that where the BoZ acts upon a request from an authorised person to accept an instruction given without following an agreed procedure (a “special instruction”), the Participant will be bound by such special instruction. The BoZ shall be indemnified from any loss, liability, claim or expense (including legal fees) attributable to executing such special instruction. where the BoZ takes any action beyond those agreed in these Rules to verify the source or content of any communication, such additional action shall not be deemed to become part of the Procedures no matter how often BoZ takes such additional action. Notwithstanding any other provision hereof, the BoZ shall have the right, in its sole discretion, to refuse to execute any instruction, provided it is acting in good faith, doubts the authenticity or authorisation thereof. The BoZ shall provide prompt response, which may be by telephone or email, or to an authorised person of any such rejected instruction.

Bank of Zambia ZIPSS Rules 30 8.3 Use of BOZ-Supplied Materials The security procedures, security devices, codes, passwords and other access methods are highly confidential and the Participants shall use and guard them with the highest care. The BoZ must be notified immediately upon discovering or having reason to suspect that any of the foregoing is or may be compromised. Where software and/or hardware provided by BoZ to a Participant incorporates features relating to security (including IDs, e-tokens and passwords and other measures) the Participant shall be solely responsible for the use of such features. The BOZ shall be entitled to assume that all use of such software and/or hardware is by persons authorised to use such facilities.

Bank of Zambia ZIPSS Rules 31 9.0 Establishment and Maintenance of Users 9.1 Token Certificate Applications Access to the ZIPSS shall only be permitted to authorised and uniquely identified users. Each user named in the corresponding E-Token Application form (as specified in Annex 15) shall be an authorised person or the designee thereof duly authorised to receive, transmit and/or confirm data and instructions within the limits, if any, specified on the applicable on the form. 9.1.2 Revocation or Modification of Tokens The BoZ shall be entitled to rely on the access rights as set forth on a e-token application form until information is received to the contrary, of a written request for revocation or modification of such application form, dated and signed by authorised signatories. In normal circumstances the application shall be processed within one business day. In exceptional cases such requests for revocation or modification may be made by secure email by an authorised signatory and will be actioned by the BoZ immediately upon receipt of the application form. The Participants undertake to disable immediately and inform the BoZ when any person authorised to utilise the ZIPSS services ceases to use the services or to be employed by that Participant. 9.2 Request to Create a User A Participant who requires to create a new user shall complete and submit to the BoZ, a duly authorised e-token application form, as provided in Annex 15, at least two business days prior to the date when the user should be created. BOZ shall reserve the right to: • allocate e-tokens; and • issue a digital certificate to the user (on the e-token). Participants through their PUSA shall be responsible for the creation and maintenance of the users on the ZIPSS, allocation of usernames, assigning predefined user profiles and assigning initial passwords.

Bank of Zambia ZIPSS Rules 32 Before a user can be registered, Participants shall ensure that the new user has undergone appropriate training to perform the functions on ZIPSS. The BoZ reserves the right to charge the cost of tokens to the Participant for all additional tokens after the ones initially issued. 9.3 Modification of a User Only PUSAs shall have the rights under dual control, to assign predetermined user profiles according to user responsibilities. In addition, PUSAs shall disable or remove a user whose access rights are no longer required by the Participant. 9.4 Creation and Maintenance of User Profiles The BoZ Administrators shall have the sole responsibility of creating all the user profiles including PUSA profiles and PUSA accounts. The PUSAs shall in turn have the responsibility of creating and assigning profiles for users consistent with the segregation of duty principles. The BoZ Administrators may, in the name and for the account of the BoZ amend information about a user, including the profile, according to the information provided by PUSAs. In addition, the PUSA shall ensure that the users they create are maintained through regular reviews for access levels and rights. The review exercise will help to curtail the possibility of having inactive accounts which can be exploited for unauthorised access.

Bank of Zambia ZIPSS Rules 33 10.0 Payment Message Format 10.1 Format For the ZIPSS Payment messages, Participants must comply with ISO 20022 formatting rules as published on the ZIPSS MyStandards and Readiness Portal. 10.2 ZIPSS Payments • The following message types shall be used in ZIPSS: • Admi.004 - System Event Notification • Admi.007 - Receipt Transaction • Camt.007 - Modify Transaction • Camt.008 - Cancel Transaction • Camt.025 - Liquidity Transfer Receipt • Camt.029 - Resolution of Investigation • Camt.046 _ Get Reservation • Camt.047 - Return Reservation • Camt.048 - Modify Reservation • Camt.049 - Delete Reservation • Camt.050 - Liquidity Transfer • Camt.052 - Bank to Customer Account Report • Camt.053 - Bank to Customer Statement • Camt.054 - Bank to Customer Debit Credit Notification • Camt.056 - Payment Cancellation Request • Camt.060 - Account Reporting Request • Camt.103 Create Reservation • Pacs.002 - Payment Status Report • Pacs.004 - Payment Return • Pacs.008 – Single Customer Credit Transfer • Pacs.009 – Financial Institution Transfer • Pacs.010 - Financial Institution Direct Debit • Pacs.029 - Multilateral Settlement Request

Bank of Zambia ZIPSS Rules 34 For more detailed information on the above message types, reference should be made to the Usage guidelines on the ZIPSS MyStandards and Readiness Portal.

Bank of Zambia ZIPSS Rules 35 11.0 Reports and Enquiry Facilities The ZIPSS shall provide the Participant with information such as: • Intraday position; • The position of the SA; • The transactions on the SA; and • The pending queue with payments yet to be settled. Other regular or adhoc reports can be viewed and printed directly from the ZIPSS application at any time.

Bank of Zambia ZIPSS Rules 36 12.0 Technical Failures In case of a technical failure of a Participant which results in failure to generate or receive payments through the ZIPSS for more than 30 minutes during the day, the Participant shall immediately inform the BoZ. The Participant shall take necessary steps to resolve the failure as soon as practicably possible. The notice shall be communicated in writing or via secure emails to zipss.helpdesk@boz.zm.

Bank of Zambia ZIPSS Rules 37 13.0 Audit Rules Each Participant shall assess its compliance with the functional, technical, organizational and security provisions, as specified in these Rules. Participants shall submit to the BoZ quarterly and yearly compliance audit certificates. The quarterly certificate shall be submitted six days following the end of the quarter while the annual certificate for the preceding year shall be submitted by the 31 March of every Calendar year. The Certificates must be submitted as specified in the form in Annex 11. The quarterly and annual compliance audit certificates must be signed by the Chief Operating Officer and the PUSA. Should the provided reports contain material errors, the Participant shall be penalized. In addition, the BoZ may require the submission of system audit reports and working documents on a regular basis. Participants shall provide to BoZ any information relating to the operations of the ZIPSS that may be required within five (5) working days of any request. The BoZ may take supervisory action in accordance with provisions of the existing National Payment Systems Act on a participant that fails to meet these requirements. The BoZ may also assess compliance with the above provisions and may examine Participants’ controls for adequacy and where necessary, make contact with the auditors of the Participants.

Bank of Zambia ZIPSS Rules 38 14.0 Pricing Rules The BoZ shall set fees and other charges for the usage of the ZIPSS which shall be notified to Participants from time to time and include: • An entry fee for new Participants; • An annual membership fee on all Participants, at the start of each calendar year through a current account held by each Participant at the BoZ; • Transaction processing fees; and • Administrative fees on Participants that do not comply with the provisions of these Rules. 14.1 Incentives The BoZ may offer incentives to control the behaviour of Participants when processing transactions. On the other hand, the BoZ may charge Penalties for infringement of these Rules. 14.2 General Instructions on Fees The ZIPSS shall calculate the fees on the basis of Participants’ usage, and will charge these fees to Participants’ SAs as stipulated in Annex 8 - Pricing The Charges shall be collected on a daily basis. By signing these rules, the Participant authorises the BoZ to effect Participant debits for settlement of fees and penalties by the Participant. The ZIPSS shall provide Participants with a report giving details of all charges and penalties. The BoZ may periodically review its fees and charges and shall ensure that details of pricing are communicated to all Participants 30 days prior to implementation. The BoZ reserves the right to charge a Participant for any additional services specifically rendered to that Participant.

Bank of Zambia ZIPSS Rules 39 15.0 Administrative Requirements and Financial Rules 15.1 Audit Trails The ZIPSS generates comprehensive audit trails which participants can access on the system. Where an auditor or any other legal entity wishes to access data about a Participant, BoZ will require a written instruction from the Participant’s Authorised signatory or certified copy of a board resolution of that Participant authorising the auditors, the BoZ or this other legal entity to access data about that Participant. The audit trails provide information: • At Participant level, the details of all transactions relating to a particular Participant; • At user level, providing a record of all accesses to the system and the actions of the users. These elements form part of the technical audit trail known as the system log; The main audit tools, apart from standard reports, are as follows: • The facility to list all transactions within the ZIPSS for the past ten years; • The facility to request from the BoZ, defined reports for audit purposes based on statistical and other tables in the database. BoZ may levy a charge to produce special reports. 15.2 Publication of Statistics The BOZ will publish monthly and annual statistics on its website concerning the volumes and value of payments exchanged through the ZIPSS. 15.3 Conservation and Archiving of Documents BoZ and the Participants shall comply with the laws and regulations applicable in Zambia concerning the conservation and archiving of documents.

Bank of Zambia ZIPSS Rules 40 For this purpose, all transactions and accounting data will be stored for a period in accordance with relevant Zambian law. All current transactions and data for the previous 10 years shall be accessible on-line in real-time.

Bank of Zambia ZIPSS Rules 41 16.0 Business Disruption Event A Business disruption Event is any event which disrupts normal processing to the extent that contingency procedures are brought into effect. The BoZ shall have the right in its sole discretion to determine and warn Participants that a contingency event has occurred. This may or may not include transfer of operations to the ZIPSS alternate site or running ZIPSS in stand-alone mode, without communication links to other systems. In case of a business disruption event, the BoZ shall have the right, in its sole discretion, to change the priority of any queued transaction from any Participant in order to facilitate the flow of funds through the ZIPSS, subject to the correct use of priorities as set out in Annex 13. The BoZ will notify the affected Participant(s) whenever such an operation is performed. Under these conditions, the BoZ shall have the right, in its sole discretion, to conduct special reconciliations with Participants including Clearing Houses and to request the necessary transaction and other information from Participants. As a result of reconciliations in a contingency situation, the BoZ may ask Participants to perform special transactions to ensure that all systems are properly synchronised. In order to comply with Bank for International Settlements (BIS) Principles for Financial Market Infrastructures3 , these transactions must be carried out before End of Day on the affected day. 3 Available at http://www.bis.org/publ/cpss101.htm

Bank of Zambia ZIPSS Rules 42 17.0 Force Majeure For the purpose of these Rules the term “force majeure” includes (but is not limited to) fires, flood, storms and other damage caused by the elements, riots, explosions, governmental action or inaction, currency restrictions, acts of God, insurrection and war and any other cause whether of the kind specifically enumerated above or otherwise which is not reasonably within the control of the party claiming force majeure. If by force majeure any Participant is rendered unable wholly or in part to carry out its obligations under these Rules (except payment obligations) or is delayed in its operations to be performed pursuant to these Rules (except payment obligations). Participants shall within 2 days from the date of commencement of such force majeure give written notice thereof to the BoZ stating the date and extent and the nature of the force majeure. The foregoing shall not prejudice the responsibility of the Participant to use all reasonable effort to mitigate the effects of any such event. In the event that a Participant has invoked the provisions of this clause and a force majeure continues for a period in excess of one (1) month, the BoZ may terminate the Participant’s participation. A Participant whose obligations (except payments) have been suspended shall promptly inform the BoZ upon resolution of the force majeure event in writing.

Bank of Zambia ZIPSS Rules 43 18.0 Claims and Compensations 18.1 Correction of an Erroneous Order Where a Participant makes a payment on the ZIPSS in error (such as a duplicate message, misdirected payments, incorrect amount, etc.), it shall request the receiving participant in writing to reverse the funds. However, if a Participant is aware that it has received a payment erroneously, the receiving Participant shall inform the sender immediately and make the reversal as a new instruction, using a pacs. 004 Return Message which shall include the original reference for reconciliation purposes. Where a reversal is made, it shall be made to the remitting account. Where the sending Participant reports the error before 12:00 hours and the erroneously credited Participant does not affect the reversal of the payment on the same day, it may claim interest for each day the funds are not reversed by the erroneously credited Participant. This interest shall be calculated on the basis of the BoZ overnight lending facility (OLF) rate. 18.2 Fraudulent or Erroneous Transactions Any loss incurred by a customer due to a fraudulent or erroneous transfer originating from a Participant due to failure in internal controls by the Participant shall be borne by such a Participant.

Bank of Zambia ZIPSS Rules 44 19.0 Dispute Resolution 19.1 Law and Jurisdiction These Rules are subject to the Zambian law. In case of a dispute between Participants or between a Participant and the BoZ, the respective rights and obligations in relation to payment instructions processed through the ZIPSS shall be determined according to the laws of Zambia and the provisions contained in these Rules, Procedures and the Annexes. 19.2 Conciliation and Arbitration Procedures 19.2.1 Conciliation Procedure In case of operational error or dispute between Participants, the Participants concerned shall find an amicable settlement and take all necessary measures to that effect. Where Participants fail to reach an amicable settlement within ten days of initiating dialogue, any party to the dispute shall escalate, in writing, to the BoZ Director Payment System. The Participants concerned shall communicate to the BoZ all necessary information and documentation. 19.2.2 Arbitration Procedure Where participants in a dispute fail to find an amicable settlement through a conciliation process within 45 days, the parties shall proceed to the Arbitration process in line with the Arbitration Act, No. 19 of 2000. The Parties agree to have one arbitrator who shall be appointed by the Chartered Institute of Arbitrators – Zambian Branch. The seat of Arbitration shall be Lusaka and the Language used during Arbitral proceedings shall be English.

Bank of Zambia ZIPSS Rules 45 20.0 Insolvency of a Participant 20.1 Notification of Insolvency Events In accordance with the National Payments Systems Act, the relevant court, which, according to the Zambian law, takes the decision of opening an insolvency proceeding against a Participant, shall immediately notify that decision to the BoZ. Insolvency is to be read as meaning that the relevant Participant is not able to pay all its debts as and when they become due and payable. A Participant must notify the BoZ immediately upon becoming aware of any insolvency event; Upon receiving any notification, the BoZ will collaborate with the Participant. The provisions of Section 7.2.1 (suspension) or 7.2.2 (disabling) may apply as a result. These notifications shall be sent to the address in Annex 12. 20.2 Payment Instructions Submitted by the Insolvent Participant The insolvent Participants shall be excluded from participating directly on the ZIPSS. The BoZ will take all reasonable steps to ensure that, only payment instructions submitted by the appointed trustee shall be presented to the BoZ for settlement. However, the insolvent Participant remains bound by the obligations resulting directly or indirectly from its participation on the ZIPSS. 20.3 Queued Payment Instructions Submitted by the Insolvent Participant All payment instructions submitted by the insolvent Participant that have been queued for settlement shall be settled in accordance with Section 11.1 of these Rules. Where the NSI remain unsettled, the BoZ shall take all reasonable steps to facilitate settlement. 20.4 Insolvency Proceedings During the Business Day Where the Operator is notified to effect the insolvency decision during the course of business day, the Operator shall block the Participant on the ZIPSS in line with the insolvency decision. The following conditions shall apply:

Bank of Zambia ZIPSS Rules 46 • All payment instructions submitted to the ZIPSS that have not been settled shall be cancelled except for the NSI transactions. • All funds available on the SA, Reserve Accounts and securities pledged for clearing transactions shall be utilised to fulfil the Participants obligations on the ZIPSS. 20.5 Insolvency Proceedings after close of Business Day Where the Operator is notified to effect the insolvency decision after close of business, the Operator shall implement the insolvency decision the next business day. The BoZ shall block or disable the Participant from receiving payment instructions.

Bank of Zambia ZIPSS Rules 47 21.0 Amendment of the Rules and Complementary Instructions 21.1 Amendment to the Rules The BoZ shall be responsible for the amendment of these Rules or the Annexes hereto, or any additional documents containing, inter alia, technical provisions and specifications for the ZIPSS, from time to time after giving the opportunity to Participants to comment on them. At any time, Participants may suggest amendments to the Rules which shall be considered in consultation with all other Participants and will be incorporated at the discretion of the BoZ. Such amendments and additional documents shall become effective as an integral part of these Rules as per the date specified by the BoZ, which date shall not precede the communication to the Participants. The BoZ will give notice to Participants of any modification within 30 calendar days before implementation of the Rules. 21.2 Complementary Instructions The BoZ may send to the Participants complementary instructions on the organisation of the system, after giving them the opportunity to comment on the instructions. Such complementary instructions shall be considered to form part of these Rules.

Bank of Zambia ZIPSS Rules 48 Annex 1: Daily Operating Timetable Monday – Friday Time Event Activities by Participants and Available Transactions 07.00 Start of Day • ZIPSS Start-of-Day • Settlement of ZIPSS charges • BOZ Housekeeping period • Only BOZ may submit transactions 07.15 Open for Business • ZIPSS is open for business and can process all transactions from all participants. Additionally; • ZIPSS shall process Net Settlement Instructions (NSIs) from the clearing house as per times set in clearing house rules for various clearing sessions • ZIPSS shall process Net Settlement Instructions (NSIs) for other clearing institutions such as the Lusaka Stock Exchange and VISA • ZIPSS transactions shall be charged differently at different times of the day as per pricing advised to all Participants by BOZ 19:00 Cut-off for Customer Payments (Initial Cut-off) • ZIPSS shall no longer accept pacs.008 payments • pacs.009 payments shall continue to be accepted 19:15 Cut-off for Interbank Transfers(Final Cut-off) • ZIPSS will repay all ILF drawings made by Participants. Participants must ensure sufficient funds on the SA to allow automatic repayment of ILF at Final Cut-off. • Only BOZ can submit ZIPSS transactions for value today. • Session closed, queue/settlement processing will cease and any ZIPSS transactions still in queues will be rejected.

Bank of Zambia ZIPSS Rules 49 • Final Cut-off reports are generated. 19.30 End of Day • ZIPSS End of Day reports available for downloading After End of Day until next Start-of￾Day • Update and Reconciliation with files sent from ZIPSS. • Participants can continue to inquire reports from the system Saturday Only Time Event Activities by Participants and Available Transactions 08.00 Start of Day • ZIPSS Start-of-Day • Settlement of ZIPSS charges • BOZ Housekeeping period • Only BOZ may submit transactions 08.15 Open for Business • ZIPSS is open for business and can process all transactions from all participants. Additionally; • ZIPSS shall process Net Settlement Instructions (NSIs) from the clearing house as per times set in clearing house rules for various clearing sessions • ZIPSS shall process Net Settlement Instructions (NSIs) for other clearing institutions such as the Lusaka Stock Exchange and VISA • ZIPSS transactions shall be charged differently at different times of the day as per pricing advised to all Participants by BOZ 14:00 Cut-off for Customer Payments (Initial Cut-off) • ZIPSS shall no longer accept pacs.008 payments • pacs.009 payments shall continue to be accepted

Bank of Zambia ZIPSS Rules 50 14:15 Cut-off for Interbank Transfers(Final Cut-off) • ZIPSS will repay all ILF drawings made by Participants. Participants must ensure sufficient funds on the SA to allow automatic repayment of ILF at Final Cut-off. • Only BOZ can submit ZIPSS transactions for value today. • Session closed, queue/settlement processing will cease and any ZIPSS transactions still in queues will be rejected. 14:30 End of Day • ZIPSS End of Day reports available for downloading Annex 2: Help Desk Contact details for the ZIPSS help desk are: Telephone: +260-211-399320 Email: zipss.helpdesk@BoZ.zm Postal address: The Director Payment Systems Department Bank of Zambia Bank Square Cairo Road P. O Box 30080 Lusaka

Bank of Zambia ZIPSS Rules 51 Annex 3: Technical Documentation As part of the technical documentation, the documentation listed below will be provided as a separate set-in addition to these rules. • The STP Message Format Specifications as published on the BoZ MyStandards and Readiness Portal • Participant Security User Guide • Participant Technical Requirements • Participant User Manual • VPN Quick Reference Guide • Certificate Authority Document • Cyber Security Guidelines

Bank of Zambia ZIPSS Rules 52 Annex 4: Swift BIC Codes BANK SWIFT BIC TEST BIC BANK OF ZAMBIA (ZIPSS) BAZAZMLA BAZAZMLA BANK OF ZAMBIA (PARTICIPANT) BAZAZMLU BAZAZMLU AB BANK ZAMBIA ABBAZMLU ABBAZMLU ACCESS BANK AZAMZMLU AZAMZMLU BANK OF CHINA BKCHZMLU BKCHZMLU ABSA BARCZMLX BARCZMLX CITIBANK CITIZMLU CITIZMLU ECOBANK ECOCZMLU ECOCZMLU FIRST ALLIANCE FALLZMLU FALLZMLU FIRST CAPITAL BANK FRCGZMLU FRCGZMLU FIRST NAT BANK FIRNZMLU FIRNZMLU INDO ZAMBIA INZAZMLX INZAZMLX INVESTRUST VSTRZMLU VSTRZMLU LUSAKA SECURITIES EXCHANGE LUSEZMLU LUSEZMLU MINISTRY OF FINANCE MINFZMLU MINFZMLU STANBIC BANK SBICZMLX SBICZMLX STANDARD CHARTERED BANK SCBLZMLX SCBLZMLX UNITED BANK FOR AFRICA UNAFZMLU UNAFZMLU ZAMBIA INDUSTRIAL COMMERCIAL BANK ZICBZMLU ZICBZMLU ZANACO ZNCOZMLU ZNCOZMLU ZAMBIA ELECTRONIC CLEARING HOUSE LIMITED ZCHLZMLU ZCHLZMLU

Bank of Zambia ZIPSS Rules 53 Annex 5: ZIPSS Webstation Configuration Each Participant will have at least one webstation for connection to ZIPSS:

1. Hardware Configuration for webstations • eToken USB. Minimum: • Any PC capable of running the supported browser. • 1 USB port. Recommended: • 8 GB RAM (Windows 10) or above. • Screen with 1024x768 resolution or above. • 1 USB port.
2. Software Configuration for webstations • Windows 10 [recommended Windows 11] or above. • Updated version of Microsoft Edge or Google Chrome browser . • Antivirus software. • etoken PKI client drivers/software.

Bank of Zambia ZIPSS Rules 54 Annex 6: Gateway/Payment Originator Connectivity Application Form ZAMBIA INTERBANK PAYMENT AND SETTLEMENT SYSTEM (ZIPSS) CONNECTIVITY APPLICATION FORM Part A To be completed by applying participant Applying Institution: Connectivity Channel Gateway Payment Originator Date of Application: Time of Application: Expected Duration: Justification for the Application: Participant Authorised Signatories: Name: Signature: Name: Signature: Part B (For use by the BoZ) Risk assessment and recommendation. Approval Approved Approved Assistant Director - PSDO Director –Payment Systems

Bank of Zambia ZIPSS Rules 55 Note: When applying for Payment Originator (PO) connectivity to the ZIPSS, Participants will be required to submit users who will be enabled on the PO. The users will then be disabled by the BoZ at end of day. Should a Participantrequire the facility the following day, they will be required to make a new application.

Bank of Zambia ZIPSS Rules 56 Annex 7: ASA Form (BANK LETTER HEAD) ASA FORM Ref: ASA / ……..…../…………. Date………/……………/……….. The Assistant Director Payment Systems Development and Operations Bank of Zambia LUSAKA Dear Sir Request to Use the Authorised Settlement Agent (ASA) facilities. We hereby request you to process the under listed transaction(s) on our behalf by debiting our account number. This request is necessitated by ………... The following are the details: Single FSI Send* Beneficiary Bank Beneficiary Bank Account Number Beneficiary Customer Name Beneficiary Customer Account Number Amount UNIQUE Reference Number to be used for these transactions (maximum of 13 additional characters). [ A] [ S ][ A ][ ][ ][ ][ ][ ][ ][ ][ ][ ][ ][ ][ ] Related customer payment information Amount in words: Yours faithfully Authorised Signatory Authorised Signatory

• Delete as appropriate

Bank of Zambia ZIPSS Rules 57 Annex 8: Pricing The Bank of Zambia shall charge ZIPSS administrative fees, transaction processing fees and penalties which shall be debited from the participants’ settlement account. The Bank of Zambia shall advise the fees and penalties to the participants in writing. The Bank of Zambia reserves the right to revise the fees and penalties from time to time.

Bank of Zambia ZIPSS Rules 58 Annex 9: ZIPSS Window Extension Application Form ZAMBIA INTERBANK PAYMENT AND SETTLEMENT SYSTEM (ZIPSS) WINDOW EXTENSION APPLICATION FORM Part A: To be completed by applying participant. Applying Institution: Date of Application: Time of Application: Duration of Extension: Reason for Application: Participant authorised Signatories:

1. Name: Signature:
2. Name: Signature: Part B (For use by the BoZ) Risk assessment and recommendation. Requesting Officer Director – Payment Systems Approval Approved NOT Approved Governor

Bank of Zambia ZIPSS Rules 59 Annex 10: ZIPSS Validation Codes High Value Payments Return Codes CODE INTERNAL RTGS CODE DESCRIPTION

1. INVDATEFMT The received message had an invalid date.
2. INVCREDINST Invalid credit institution
3. INVDEBINST Invalid debit institution
4. INVSND Invalid message sender
5. INVRCV Invalid message receiver (This should always be the RTGS BIC.)
6. INVPART The receiver of the message doesn’t support this message format.
7. INVCURR The received message specifies an invalid currency.
8. INVAMT The amount is invalid as per the following cases: • Sum of debits is different than the sum of credits for NSI. • Credit amount is 0 for NSI.
9. DUPREF The message is a duplicate
10. INVDATE The received message has an invalid date: past date.
11. INVDATEEOD The message specifies a date which is closed already for business.
12. INVDATEIC The message was received after Initial Cutoff.
13. INVDATEFC The message was received after Final Cutoff.
14. INVBUSSDATE The received message refers to a not working business date.
15. INVBUSSDATEFUTURE The value date is ahead with more than the allowed number of days.
16. INVMTTYPE The received message has an invalid (unsupported) message type.
17. INVSIG The digital signature could not be verified (failed the validation).
18. INVGW The message was not sent using the gateway of the payment sender.
19. INVDEFPROCTTC No default TTC defined for this type of transaction or one TTC defined for a message type was used for another message type.

Bank of Zambia ZIPSS Rules 60 20. INVTRANTYPEFORTTC The TTC specified belongs to a different Class of TTCs and cannot be used. (transaction type and TTC do not match). 21. INVTTCPARTTYPE The TTC cannot be used with this sender’s Participant Type. 22. INVRESERVEOWNER The owner of the requested reserve operation does not match the sender. 23. CANUSR Transaction was cancelled manually in RTGS by an RTGS user. 24. CANPENTIME Transaction was cancelled due to exceeded amount of time it was in PENDING. 25. CANFCO Transaction cancelled automatically by RTGS at Final Cutoff. 26. CANINVDEB Invalid debtor in MNSB part (account or Participant cannot be found); Debit party is not Bank of Zambia in case of IDL. 27. CANINVCRED Invalid creditor in MNSB part (account or Participant cannot be found). 28. CANINVACC The specified account number was not found for the owner 29. CANBLKDEB The Debtor party is Blocked 30. CANBLKCRED The Creditor party is Blocked 31. CANINVTTC The specified TTC is invalid or doesn’t exist 32. INVCREDAGENT An invalid credit agent value wasfound in the message. 33. INVDEBAGENT An invalid debit agent value was found in the message. 34. CANFORBIDPEND Transaction was cancelled because pending/queueing is not allowed for this transaction type. 35. INVFMT An invalid message was received which didn’t pass at least one schema rule validation. Rejection Reasons CODE DEFINITION DEFINITION AGNT IncorrectAgent Agent in the payment workflow is incorrect. CURR IncorrectCurrency Currency of the payment is incorrect. CUST RequestedByCustomer Cancellation requested by the Debtor.

Bank of Zambia ZIPSS Rules 61 CUTA CancelUponUnableToAppl y Cancellation requested because an investigation request has been received and no remediation is possible. DUPL DuplicatePayment Payment is a duplicate of another payment. UPAY UnduePayment Payment is not justified.

Bank of Zambia ZIPSS Rules 62 Annex 11: Audit Forms Quarterly Audit Form REVIEW OF USERS ON THE ZAMBIA INTERBANK PAYMENT AND SETTLEMENT SYSTEM QUARTER ENDED: Submitted six (6) business days after month end on: Kindly provide responses to the following questions.

1. Have you undertaken a review of users on ZIPSS?
2. Specify the reason and names of users who have been disabled. No. Name of User Profile Reason for Disabling
3. Specify the reason and names of users who have been removed. No. Name of User Profile Reason for Removing
4. Specify the reason and names of users whose certificates have been revoked. No. Name of User Profile Reason for Revoking Signed by: Head of ICT Participant User Administrator

Bank of Zambia ZIPSS Rules 63 Annual Audit Form Annual Audit Certificate for the preceding year to be submitted by 31st March of every Calendar year Participant: Self-Assessment for Period Please respond to the following questions A. Review of User access

1. Have you reviewed the access levels and rights (User Profiles) of all your ZIPSS users?
2. Are you satisfied that all users continue to have the correct access levels and rights?
3. Have you reviewed the ZIPSS user list for active, disabled and removed dormant/ unauthorised users?
4. Have you reviewed the ZIPSS user list report? Attach a list of active ZIPSS users signed by two (2) authorized signatories. B. ZIPSS-related fraud
5. Has your organization experienced any ZIPSS-related actual or attempted fraud during the year?
6. If so, was this reported to BoZ in accordance with the ZIPSS Terms and Conditions?
7. Was the means of the fraud identified and rectified?

Bank of Zambia ZIPSS Rules 64 4) Did the fraud result in any financial loss to your organization or to its customers? 5) If so, is recovery still being sought? C. Cyber Security

1. Does your organisation have a cyber-security management framework?
2. Are you satisfied that the cyber-security risks have been analysed and addressed?
3. Has your organization experienced any ZIPSS-related cyber-attacks or attempted attacks during the year?
4. If so was this information shared with stakeholders including BoZ?
5. Was the means of the cyber- attack identified and rectified?
6. Did the attack result in any financial loss to the organization or its customers? If so, is recovery still being sought.
7. Has your organisation conducted cyber security training for the ZIPSS users? D. Contingency planning and contingency facilities
8. Does your organization have a documented contingency plan for its ZIPSS operations?
9. Does the plan satisfactorily cover significant potential contingency scenarios?
10. Does your organization maintain fall-back computer facilities and/or communications for the SWIFT interface used for ZIPSS communications?
11. If your organization does maintain a fall-back computer facility, is it at a separate site to your main SWIFT computer facility?
12. Are you satisfied that potential business risks have been analysed and addressed? E. System down time and resilience

Bank of Zambia ZIPSS Rules 65

1. Have your ZIPSS operations been subject to significant or recurring downtime or disruption?
2. If so, were these reported to BoZ and recorded in a Contingency Event log in accordance with the ZIPSS procedures?
3. Are you satisfied that your ZIPSS-related systems have sufficient capacity and resilience to service your ZIPSS payment traffic in a timely and safe manner? Signed by: Head of ICT Participant User Administrator

Bank of Zambia ZIPSS Rules 66 Annex 12: Notification Any notice pursuant to these Rules shall (unless otherwise specified) be conveyed by mail, e-mail, or delivery by messenger, and shall be effective only upon receipt. Any such notice shall be:

1. Mailed or delivered to: The Director Payment Systems Department Bank of Zambia Bank Square Cairo Road P. O Box 30080 Lusaka
2. Or emailed to: zipss.helpdesk@BoZ.zm The BoZ may notify the Participants in writing of any change in contact details.

Bank of Zambia ZIPSS Rules 67 Annex 13: Message Priorities Message Type TTC Types TTC Priority Default Range MT298 SMT 201 ZECHL TTC, LuSE TTC and VISA TTC 35 31 to 40 pacs.008 pacs.008 Default TTC 80 71 to 80 pacs.008 to BOZ pacs.008 Bank to BOZ TTC 45 45 pacs.009 pacs.009 Default TTC 65 61 to 70 pacs.009 to BOZ pacs.009 Bank to BOZ TTC 41 41 Pacs.010 Financial Institution Credit Default TTC 55 41 to 59 Pacs.010 for Billing Billing TTC 45 41 to 50 MT298 SMT 220 CSD Transfer Default TTC 45 41 to 50 MT298 SMT 220 CSD Collateral Setup Default TTC 25 21 to 30 MT298 SMT 220 CSD 220 Transfer 40 40 MT298 SMT 220 CSD Redemptions 35 31 to 35 ILFDD ILF Drawdown Default TTC 35 20 to 45 ILFREV ILF Reversal Default TTC 15 11 to 20 RESMOV Reserve Operation Default TTC 55 51 to 60 pacs.009 Cash Reserve TTC 55 51 to 60

Bank of Zambia ZIPSS Rules 68 Annex 14: Form for Participant Addition or Modification Application to Add or Change a Participant in ZIPSS To: The Director – Payment Systems Payment Systems Department Bank of Zambia Bank Square - Cairo Road P. O Box 30080 Lusaka From: Name of applicant or ZIPSS Participant: Place of Incorporation Company Registration Number: Registered Office Address/ Principal Place of Business in Zambia: Complete the following details about the way you want your organization's details held in ZIPSS (strike out whatever is not appropriate) Requested action: Add / Change Participant Name: Participant address: BoZ licence number SWIFT BIC: Telephone no: Fax no: Debit advice camt.054 required: Yes / No

Bank of Zambia ZIPSS Rules 69 Credit advice camt.054 required: Yes / No Statement camt.053 required: Yes / No Billing statements to be sent: None / Daily / Weekly / Monthly Approving officer’s title: Signature: Dated: EXECUTED by THE APPLICANT or in the presence of: (Signature of Secretary/Director) (Signature of Director) (Full name of signatory) (Full name of signatory)

Bank of Zambia ZIPSS Rules 70 Annex 15: E-Token Application Form Bank of Zambia BOZ ZIPSS/CSD SYSTEM e-TOKEN APPLICATION FORM Form No ZIPSS/BOZCSD/CA02 Name of Participant Participant’s ID (3 chars) Physical Address of Participant

1. APPLICATION DETAILS Name of Originator (Participant’s User Security Administrator - PUSA) Date of Application Subscrib er’s First name Initial (optional ) Surname Subscriber’s Designation User ID (assigned by PUSA) Subscriber’s E-mail address e-Token Usage (Tick where applicable) ZIPSS Only CSD Only Both ZIPSS and CSD User Profile (To be ticked by PUSA) Specify the profile that the user has been assigned by the PUSA on the system ZIPSS Profile CSD Profile First time/Renewal application First time Renewal

Bank of Zambia ZIPSS Rules 71 (Tick where applicable) 2. AUTHORIZATION: By signing this form, the Participant’s authorized signatories certify that the subscriber herein has completed the ZIPSS/CSD User training appropriate to the functions to be performed as required by Bank of Zambia. Participant’s Authorized Signatories (Registered with the Bank of Zambia) 2.1 ZIPSS SYSTEM Name Designation Comment Signature Date 1. 2. 2.2 CSD SYSTEM Name Designation Comment Signature Date 1. 2. 3. APPROVALS at Bank of Zambia 3.1 ZIPSS Approval Manager (Payment Systems Department) Name Designation Comment Signature Date 3.2 CSD Approval Manager (Financial Markets Department) Name Designation Comment Signature Date 4. e-Token Issuance – Only issue after all above information is provided and form is duly signed Date Received Time Received Subscriber’s Name BOZ ZIPSS/CSD User ID Certificate Issuance Approval (Tick) Yes No Reason if not approved Name of BOZ CA Approver Signature Date e-Token Serial No Certificate ID Issue No Renewal No

Bank of Zambia ZIPSS Rules 72 Date of Issue Expiry Date Issued by: (BOZ CA Security Administrator – CASA) Signature 5. Delivery to BOZ ZIPSS/CSD Service Desk Received by BOZ ZIPSS/CSD Service Desk for Collection Name Signature Date Time

Bank of Zambia ZIPSS Rules 73 Annex 16: E-Token Revocation Form Bank of Zambia BOZ ZIPSS/CSD SYSTEM e-TOKEN REVOCATION FORM Form No BOZ ZIPSS/CSD CA03 Name of Participant Participant’s ID (3 chars) Physical Address of Participant

1. REQUEST DETAILS Name of Originator (Participant’s User Security Administrator

• PUSA) Date of Application e-Token Serial No Certificate ID Subscriber’s First name Initial (optional ) Surname Subscriber’s Designation User ID Subscriber’s E-mail address Reason for Revocation

2. AUTHORIZATION Participant’s Authorized Signatories (Registered with the Bank of Zambia) 2.1 ZIPSS SYSTEM Name Designation Comment Signature Date and Time

Bank of Zambia ZIPSS Rules 74 2. 2.2 CSD SYSTEM Name Designation Comment Signature Date and Time 1. 2. 3. APPROVALS at Bank of Zambia 3.1 ZIPSS Approval Manager (Payment Systems Department) Name Designation Comment Signature Date and Time 3.2 CSD Approval Manager (Financial Markets Department) Name Designation Comment Signature Date and Time 4. e-Token Revocation – Only action after all above information is provided and form is duly signed Date Received Time Received Subscriber’s Name BOZ ZIPSS/CSD User ID 4.1 Name of BOZ CA Approver Name Designation Comment Signature Date and Time 4.2 Revoked by BOZ CA Security Administrator – CASA Date revoked Time Revoked Has Notification of Revocation been sent (Y/N)? Name Signature

Bank of Zambia ZIPSS Rules 75 Annex 17: RTGS Transaction Type Codes TTC Type TTC Code TTC Priority Default Range ZECHL TTC 0010 35 31 to 40 LUSE TTC 0020 35 31 to 40 VISA TTC 0030 35 31 to 40 103 Default TTC 1030 80 71 to 80 MT103 Bank to BOZ TTC 1031 45 45 202 Default TTC 2020 65 61 to 70 MT202 Bank to BOZ TTC 2021 41 41 204 Default TTC 2040 55 41 to 59 205 Default TTC 2050 55 41 to 59 Billing TTC 2140 45 41 to 50 CSD Transfer Default TTC 3010 45 41 to 50 CSD Collateral Setup Default TTC 3020 25 21 to 30 CSD 220 Transfer 3030 40 40 ILF Drawdown Default TTC 4000 35 20 to 45 ILF Reversal Default TTC 4010 15 11 to 20 Reserve Operation Default TTC 5000 55 51 to 20 Cash Reserve TTC 5010 55 51 to 60 Emergency Funds Transfer 9999 30 30

Bank of Zambia ZIPSS Rules 76 Appendix 1: Glossary of Terms Full Name Short Name Explanation/Definition Acceptance (for settlement) Acceptance The moment at which an RTGS Payment Instruction becomes irrevocable. This is the point at which a transaction passes the tests to determine whether there are sufficient funds for the transaction to proceed. Administrator Admin Authorised BoZ official involved with the administration of ZIPSS and its component modules. Audit Trail Audit Trail A sequential record of events having occurred in a system containing detailed information to assist subsequent incident analysis. Participants can view the audit trail of individual transactions. Only BoZ can view the full audit report. Authentication Authentication The methods used to verify the origin of a message or to verify the identity of a Participant connected to a system. See also Digital Certificate and Digital Signature. Authorised Person Authorised Person Person duly authorised by all necessary action to access data and/or to provide instructions with respect to bank accounts, funds transfers and other financial transactions by electronic means and/or person designated to access such data and to provide instructions, on behalf of the Participant in connection with the Services and the limitations, if any, upon such authority.

Bank of Zambia ZIPSS Rules 77 Full Name Short Name Explanation/Definition Authorised Settlement Agent ASA A facility to that allows the Bank of Zambia to process transactions on behalf of Participants in cases where a Participant is unable to process transactions on ZIPSS Authorising Officer Authorising Officer Person mandated to grant authority to other individuals at the Participant’s location in relation to performing designated activities on ZIPSS. Automated Clearing House ACH An electronic central clearing facility for transferring funds whether in real time or in batches. Available balance Or Available funds Available bal The funds available for settlement of transactions at any point in time. Calculated using pre-defined components, including opening balance, the net value of credits and debits processed, minimum reserve requirement, borrowed funds, cash reserve requirement and account limits (if any). This for forms part of a Participant’s overall Liquidity. Back-up Back-up Refers to the process of keeping off-site mirrored (real-time) copies of essential system files, including the ZIPSS database to ensure that the system can be recovered within the timeframes specified in relevant Service Level Agreements (SLA) in the event of the main production system failing or other disaster events occurring. Also used to refer to the copy files.

Bank of Zambia ZIPSS Rules 78 Full Name Short Name Explanation/Definition Beneficiary Ben The recipient of a credit transfer payment Bank of Zambia BoZ The Central Bank of Zambia established under the Constitution of Zambia (Amendment) Act No. 2 of 2016 as read together with the Bank of Zambia Act number 5 of 2022 and operator of ZIPSS. Bank of Zambia Act BoZ Act The Bank of Zambia Act number 5 of 2022 Batch Batch The transmission or processing of a group of payment orders or securities transfer instructions as a set on an all-or-nothing basis. This implies that a batch may not be partially settled on ZIPSS Business Identifier Code BIC A unique address that identifies precisely the financial institutions involved in international financial transactions. SWIFT BICs are used in ZIPSS. A SWIFT BIC consists of eight or eleven characters comprising the first three or all four of the following components: Bank Code (4), Country Code (2), Location Code (2) and optional Branch Code (3). SWIFT BICs are allocated and managed by SWIFT. Unlisted BICs may also be issued by BoZ for participants that do not process through the SWIFT network.

Bank of Zambia ZIPSS Rules 79 Full Name Short Name Explanation/Definition Block Block A BoZ-only action taken via a ZIPSS menu function which prevents a specific Participant from sending and or receiving payment messages to and from the system. Business Continuity Management BCM A payment system’s arrangements that aim to ensure that it meets agreed service levels even if one or more components of the system fail or if it is affected by an abnormal external event. Include both preventative measures and arrangements to deal with contingencies. Business Day Business Day A day on which ZIPSS is operating to process payments. Collateral Collateral An asset that is delivered by the collateral provider to secure an obligation to the collateral taker. Collateral arrangements may take different legal forms; collateral may be obtained using the method of title transfer or pledge of assets.

Bank of Zambia ZIPSS Rules 80 Full Name Short Name Explanation/Definition Constraining Event Constraining Event Processing, communications or other failure of a technical nature; Inaccessibility (total or partial) to facilities by means of which payments are sent and received; or Manifestation of industrial action, which affects, or may affect, the ability of any Participant to participate to the normal and usual extent in sending and receiving payments. Contingency Event Contingency Event Any Constraining Event or any other event or circumstance specified by BOZ. Customer Payment Customer Payment A payment message for customer transfers used to move funds from one financial institution to another financial institution Cut-off Cut-off A designated time beyond which certain ZIPSS functions cannot be performed, as specified in Annex 1. Deferred Net Settlement DNS A bilateral or multilateral settlement mechanism where settlement takes place on a net basis and there is a time lag between the transmission of payments from Participants to ZIPSS, their acceptance for settlement and the actual settlement.

Bank of Zambia ZIPSS Rules 81 Full Name Short Name Explanation/Definition Delivery versus Payment DvP Mechanism used in securities transfer transactions, which ensure that the final transfer of ownership of the securities (the delivery) can be considered completed only if the actual payment for the transaction has been made. Digital Certificate Digital Certificate An encrypted text, which enables devices such as electronic tokens to be authenticated by the system and system components to authenticate each other, using Public Key Infrastructure (PKI) methods (see PKI). Digital Signature Digital Signature A string of data generated by a cryptographic method that is attached to a message to ensure its authenticity as well as to protect the recipient against repudiation by the sender. Disable Disable A BOZ-only action taken via a ZIPSS menu function, which prevents a specific Participant from being able to send transactions or to access the system. e-token e-token A Universal Serial Bus (USB) token which carries an embedded chip with memory and/or processor functions in which is contained a Digital Certificate allocated to a specific User. End-of-day EOD End of the Business Day for ZIPSS (see Annex 1).

Bank of Zambia ZIPSS Rules 82 Full Name Short Name Explanation/Definition Fall-back Fall-back Documented contingency arrangements to be initiated in the event of a failure or disruption to service. Final-Cut-off FCO Time at which ZIPSS cuts off processing of ZIPSS interbank transactions and cancels any queued ZIPSS Payment transactions for same day value (see Annex 1). Force Majeure Event Force Majeure Event French for "Superior Force". A clause used in contracts that frees all signatories from liability due to a "chance occurrence or unavoidable accident". This includes, inter alia, acts of war, terrorism, natural disaster, or political intervention. Foreign Exchange FX Any currency other than Zambian Kwacha (ZMW), also used for the process of buying and selling currencies. Gateway Gateway An element of the ZIPSS software for the integration of ZIPSS with Participant banks’ existing back-office and client services. It links the bank’s internal systems with ZIPSS via Java Messaging Service (JMS) and the Virtual Private Network (VPN). General Ledger GL BOZ’s General ledger in which BOZ’s accounts, including those it holds for the banks, are held.

Bank of Zambia ZIPSS Rules 83 Full Name Short Name Explanation/Definition Government of the Republic of Zambia GRZ An elected body of representatives empowered under the Constitution of Zambia to legislate and enforce the laws of the country; to tax, apply Customs' duties and fees; and appropriate monies for public goods and services on behalf of the citizens and other inhabitants of Zambia Gridlock Gridlock A situation that can arise in a funds or securities transfer system in which the failure of some transfer instructions to be executed (due to insufficient funds or securities balances) prevents fulfilment of a substantial number of instructions given by other Participants. Gridlock Resolution Gridlock Resolution Resolution of the gridlock condition without overdrawing the accounts involved. Gross Settlement Gross Settlement The Settlement of funds and securities transfer, which is effected individually on an order-by-order basis, that is, without netting debit against credit payment transfers. Government Securities Government Securities Securities issued by the Government of the Republic of Zambia. Initial-cut-off ICO Time at which ZIPSS cuts off processing of ZIPSS transactions other than inter-bank transactions as indicated in Annex 1.

Bank of Zambia ZIPSS Rules 84 Full Name Short Name Explanation/Definition Insolvency Event Insolvency Event Any collective measure provided for in the law of Zambia or a third country, either to wind up the Participant or to reorganise it, when such measure involves the suspension of, or the imposition of limitations on, transfers or payments, such as an adjudication order, a request for composition, extension or suspension of payment, moratorium, liquidation and other similar judicial procedures. Interbank Transaction Interbank Transaction A payment message used to move funds from a debtor to a creditor, who are both financial institutions Interface Interface The common boundary between two functional elements, two layers of system architecture, or between two physical devices that is defined by its functional characteristics, common physical characteristics of the link between them, signal or other characteristics. Intraday Loan Facility ILF Credit extended for a period of time that is less than one Business Day. The credit is provided by BOZ for the purpose of providing liquidity for a Participant in ZIPSS.

Bank of Zambia ZIPSS Rules 85 Full Name Short Name Explanation/Definition International Organisation for Standardisation ISO A worldwide federation of national standards bodies from some 140 countries. The mission of ISO is to promote the development of standardisation in order to facilitate the international exchange of goods and services. In writing In writing (i) On paper, signed by an authorised person of the sender; or (ii) by e-mail containing a document signed by an authorised person Java Messaging Service JMS A software function for the exchange of messages between computers. Local Area Network LAN A computer network that spans a relatively small area, generally confined to a single building or group of buildings. Liquidity Liquidity The measure of a Participant’s ability to meet its current obligations in respect of funds and/or securities transfer. In the context of Automated Transfer Systems, this is measured in the system by four components: available funds (balance) on the SA, queued payment transfers from other Participants to its account, credits extended by the central bank and funds from interbank money market transactions. Lusaka Stock Exchange LuSE The securities exchange in Zambia, that deals in corporate shares, Government bonds and other bonds

Bank of Zambia ZIPSS Rules 86 Full Name Short Name Explanation/Definition Materials Materials These Rules and each related Annex and attachment thereto and hereto, supplemented by User Manuals, data, processes and other documentation provided by BOZ. National Payment Systems Act Number 1 of 2007 NPSA The Act that governs the management and regulation of the National Payment Systems in Zambia Net Settlement Instruction NSI The settlement of funds transfers between or among counterparties on a net basis. An NSI contains debits and credit for banks which sum to zero. The NSI is passed to ZIPSS where the banks’ SAs are debited and credited accordingly. Netting Netting An agreed offsetting of obligations between two or more parties or Participants. Operational hours Operational hours The system day of ZIPSS, which is defined through a number of operating ‘windows’ as detailed in Annex 1. Participant Participant An organization authorised to access and participate on the ZIPSS by BOZ. Payment Payment The payer’s transfer to the payee against a payee’s monetary claim in a manner acceptable to the payee. Payment Instruction Payment Instruction An instruction requesting the transfer of funds.

Bank of Zambia ZIPSS Rules 87 Full Name Short Name Explanation/Definition Payment Message Payment Message A set of data transferred via an electronic mechanism which specifies the Sender and Beneficiary of the transaction, the amount to transfer and the value date, and which enables the settlement of the transaction between Participants in a Payment System. Payment Originator PO Part of the ZIPSS software, which is a web￾based application that enables authorised users at a Participant/BOZ to enter transactions. Payment System Payment System A system used to settle financial transactions through the transfer of monetary value. Pending Queue Pending Queue A queue within ZIPSS that holds Payments awaiting settlement that cannot be immediately settled due to insufficient funds in the SA of a Participant Pledge Pledge A delivery of property to secure the performance of an obligation owned by one party (debtor/pledger) to another (secured party/pledgee). A pledge creates a security interest in the property so delivered. Profile Profile A list of functions that can be accessed in ZIPSS that are assigned to a particular User or group of Users thereby limiting access to only those functions for that User or group of Users.

Bank of Zambia ZIPSS Rules 88 Full Name Short Name Explanation/Definition Public Key Infrastructure PKI A highly secure method for securing access and information transfer based on the use of Public and Private keys. Allows for data encryption, server authentication, message integrity, and client authentication for connections between the user’s browser and the application server. Can be used to achieve non-repudiation of transactions. Primary Site Primary Site The ZIPSS principal operating site. Procedures Procedures The activities and the methods designated in these Rules. Repurchase of Securities Repo An agreement in which money is advanced against securities with a change in beneficial ownership of the securities, on the basis that they will be bought back at an agreed later time. Real-Time Gross Settlement RTGS An electronic form of funds transfer, where the transmission and settlement take place in real time and on an individual basis. Reserve Account RA Accounts within ZIPSS SAs which enable Participants to set aside funds for specific purposes. Funds in reserves may only be used to settle transactions with specific Transaction Type Codes (TTC) – e.g. NSI transactions for specific Clearing Houses.

Bank of Zambia ZIPSS Rules 89 Full Name Short Name Explanation/Definition Participant User Security Administrator PUSA An authorised person at a Participant who has access to ZIPSS for the purpose of maintaining user details and the profiles of user in ZIPSS. A Security Administrator cannot have access to ZIPSS payment entry, management and enquiry functions. Sender Sender The originator of a payment instruction Settlement Settlement The process of debiting and crediting Participants’ SAs such that the payment is final and unconditional at the time that the SAs of the relevant Participants have been credited and debited. Settlement Account SA The account held by each Participant with BoZ, used to hold funds and settle transactions between Participants. Service Level Agreement SLA A contractual document signed between BoZ, and Participants; and BOZ and other Service Providers defining the operational ZIPSS service levels. Statutory Reserve Requirements SRR The amount of reserve funds that a Participant is required to deposit with BoZ. It is calculated as a percentage of the total Kwacha deposit liability. Services Services Means all functions provided or to be provided by BOZ to Participants pursuant to these rules.

Bank of Zambia ZIPSS Rules 90 Full Name Short Name Explanation/Definition Straight Through Processing STP The connection of one computer system to another to enable automatic exchange of transactions Substitution Substitution Recalling the securities pledged, under repo or lent from a borrower and replacing them with other securities of equivalent market value during the life of the transaction concerned. Society for Worldwide Interbank Financial Telecommunicati on Swift International institution owned by banks which enables electronic messages to be sent securely between banks and financial institutions. System Operator System Operator The organisation that owns and has legal responsibility for operating a payment system and lays down operating rules. Technical Acceptance ACTC The point at which ZIPSS has validated the format of a message or batch. Technical Operator Technical Operator The organisation that has technical responsibility for running a system. Transaction Type Code TTC A Code to identify certain types of payment messages and how they should be processed. TTCs are listed in Annex 17.

Bank of Zambia ZIPSS Rules 91 Full Name Short Name Explanation/Definition User User An Authorised Person who has access to ZIPSS. User Manual/ Guides User Manual/ Guides Documentation defining how to use ZIPSS. Value date Value date The Business Day on which the amount of a successful Payment Instruction will be at the disposal of the receiving bank (payee) or its client. Virtual Private Network VPN Dedicated telecommunications networks connecting all Participants to BOZ. Zambia Interbank Payment and Settlement System ZIPSS A settlement system operating under the authority of BoZ designated to facilitate secure and reliable transfer of financial transactions between two or more parties. Zambian Kwacha ZMW The currency of the Republic of Zambia, issued and managed by the Bank of Zambia. Zambia Revenue Authority ZRA The institution authorised by the Government of the Republic of Zambia to collect tax revenue its behalf.